Is it possible to access Ivy's RESTful API from an HtmlDialog or within the same session?

Question

Hi Ivy Team

I have a HtmlDialog containing several links to our RESTful API (implemented using Axon.ivy). However, every time the user accesses to the API, the browser requires authentication even though the user has already logged in.

I'm aware of the javax.annotation.security.PermitAll/DenyAll (-- which seems to be the only annotations supported?) but I want to keep the Basic authentication intact.

Say the page could be like this:

< !-- The HelloWorld dialog -->
< h:html>
    < h:body>
        < h:outputLink value="/ivy/api/designer/helloworld" target="_blank">
            Click to see Hello World
         < /h:outputLink>

        < h:outputLink value="/ivy/file/designer/session/some_file_already_created.txt" target="_blank">
            Get content of file
        < /h:outputLink>
    < h:/body>
< /h:html>

The first link will require authentication whereas the second works normally.

Is there a possible way to overcome this?

Accepted Answer

LE Version 7.1+:

Since version 7.1 the Ivy Engine is able to reuse the authenticated session for the REST service call. This was implemented with XIVY-1183.

Note that the Engine will check for the CSRF (X-Requested-By) mitigation in the header. See chapter Engine REST Integration in our documentation.

LTS Version 7.0.11+:

We applied these changes to the LTS version 7.0.11 (story XIVY-3119).

Note that by default this feature is switched off and the Engine is also not checking for the CSRF header token. In order to enable the session reuse you need to set the following Java system properties to true:

IVY_REST_SERVLET_SESSION_REUSE
IVY_REST_SERVLET_CSRF_PROTECTION

For security reasons it is highly recommended to enable the CSRF mitigation when enabling the REST session reuse.

Is it possible to access Ivy's RESTful API from an HtmlDialog or within the same session?

LE Version 7.1+:

LTS Version 7.0.11+:

Follow this question

Related questions